As new technology grows both the amount and the worth of data, the governing body carries more responsibility for making sure data is used ethically, worthwhile opportunities are taken, and sensitive data is kept safe and secure. It should give direction on, and keep enough oversight of, how data and the technology behind it are used, so the organization remains inside its risk appetite and risk framework. This can involve: a way of understanding and following the rights, duties and limits attached to data sets (privacy, intellectual property); an information security management system based on risk; proper audit and monitoring of technology for responsible and ethical use, for the governing body's expectations and for compliance obligations; innovation processes that assess technology change quickly and update governance policies to seize opportunities; attention to human behaviour when technology is applied, covering safety, fitness for purpose and fit with the organization's purpose; and regard for stakeholders more widely, human capital in particular (referenced sources: ISO/IEC 27001, ISO/IEC 38507 and the ISO/IEC 38505 series).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.